Shape Security is the bot and fraud defense F5 bought in January 2020, and it ships today as F5 Distributed Cloud Bot Defense. F5 says the product "uses real-time behavioral analysis, client-side intelligence, and platform-wide telemetry". For a scraper, the client-side part decides almost everything. On October 22, 2026, we sent a plain request with a Chrome user agent from a home internet connection to Nordstrom, an F5 Shape store. It answered 200 OK with a 256,700-byte page that had no title and none of the store's text, only an obfuscated script. Our datacenter server got the same page.
This guide covers what Shape is, what F5 says it reads, how its first answer looks, where we met it in a test of 52 stores, and what to line up against it. We sell residential proxies, so we have a stake in the address part of the problem. With Shape, that part is small, and this page says so.
What is F5 Shape?
Shape Security built defenses against automated attacks and fraud. F5 announced the purchase on December 19, 2019 and completed it on January 24, 2020, describing Shape as "a leader in online fraud and abuse prevention, adding protection from automated attacks, botnets, and targeted fraud", and citing "Shape's insight from mitigating 1 billion application attacks per day". The technology is sold today as F5 Distributed Cloud Bot Defense, and F5's product page no longer uses the Shape name. Scrapers, forum threads and job adverts still do, which is why one wall goes by three names.
F5 says the product protects "web apps, mobile apps, and APIs", and names where the attacks land: "bots and AI-driven automation target login, checkout, account recovery, and APIs to commit fraud". That focus on transactions explains much of what a scraper meets.
Can residential proxies get past F5 Shape?
Not on their own. In our test the first answer did not depend on the address at all:
Nordstrom sent the script page to our home connection and to our server alike, and our server's text reader found zero words of store content in it. A browser runs that script, and the script's telemetry decides what comes next. A plain client never runs it, so the address it came from never got the chance to matter. Macy's, an F5 Shape store in our August test, refused the plain client from Akamai's edge before any F5 code was involved.
A residential address still earns its place. Behind a real browser, it keeps a hosting range from counting against a client that already has to prove itself, and it puts you in the country the site serves. It is the smaller half of the job here.
How do you know you hit Shape?
Shape is hard to name from the outside. Wappalyzer, which reports the technology behind websites, has no entry for it, and The Web Scraping Club's handbook says its "Wappalyzer Chrome Extension doesn't seem to recognize it". The signs we saw and that practitioners report:
- A 200 that holds only a script. Nordstrom's answer had an empty title, two scripts and no store text, and the first script began
window['istlWasHere'] = true;before a long obfuscated function. - A page that loads and then fails on the action. F5 names login, checkout, account recovery and APIs as what it protects, and our August test found the F5 stores among the "behavioral defenses that admit you and then score the session".
- A site that breaks with developer tools open. The Web Scraping Club reports that Shape-protected sites "stop to work" in an incognito window with developer tools open, and work again once they are closed.
- Another vendor in front. Shape often sits behind or beside another defense: at Macy's the refusal came from AkamaiGHost.
What F5 Shape checks
F5 publishes three phrases about its detection and little else: "real-time behavioral analysis, client-side intelligence, and platform-wide telemetry". Read against what we saw, they map onto three layers.
The client-side script
The obfuscated script on that first page is the client-side intelligence. It runs in a real browser and reports what it measures, and the session continues or stops on that report. A plain client cannot produce it, and a stock headless browser produces a version with automation tells in it. F5 does not publish what the script reads.
Behavior on the pages that matter
F5 says it can "Detect human-like bots beyond signatures", and points its defense at login, checkout and account recovery. A scraper that reaches a product page can still be stopped at the search, the cart or the sign-in, where behavior over the session is judged.
Platform-wide telemetry
The same defense sits in front of many large sites, and F5 says it uses telemetry across its platform. What a client did elsewhere can therefore count on the next site.
First request
no telemetry yet
Script page
a 200 with no store content
Browser telemetry
only a real browser sends it
Scored session
watched hardest at login and checkout
Where we met Shape
No public counter reports Shape, so our own test is the measure we have. On August 24, 2026, we sent one plain request to 52 US retail storefronts from a home connection and from a datacenter server:
Two thirds of the time it was one layer of a stack, beside Akamai, Cloudflare, Kasada or DataDome. That is why a Shape store can refuse you with another vendor's page, as Macy's did, and why the retail bot-defense study counts layers as well as vendors. In August, Abercrombie loaded for the home request and refused the datacenter one; the two requests also came from different clients, so the address alone is not proven there.
Stacks also change. In October, Abercrombie showed our home connection and our server a "Client Challenge" page that set a _fs_ch_st_ cookie. Fastly's documentation names that cookie as the start of its own challenge, so the first wall there was Fastly's. The vendor you meet first can differ from one visit to the next.
Sticky sessions and a patient pace
The session is built by the script and judged on behavior, so it rewards consistency:
- One sticky exit per session. Keep one residential address for a browsing flow so the script's telemetry, the cookies and the address tell one story. For logged-in work, a static ISP proxy keeps the same exit for days. Our sticky and rotating sessions guide shows how sessions are set.
- Enter the way a person would. Start at the homepage, let the script run, then move on. A cold landing on a deep URL gives the defense nothing but the request.
- Go slowest where F5 looks hardest. Search, cart and sign-in pages are where its behavioral checks concentrate.
The half proxies cannot touch
A proxy forwards your bytes untouched. If those bytes come from a client that never runs the script, a residential address means F5 serves a residential address its script page.
The proxy fixes
The hosting-range strike
a home address does not count against you
The exit country
the site's own market
Still on you, the bigger half here
The client-side script
only a real browser runs it
Handshake and headers
a raw client matches no browser
Behavior at login and checkout
pacing and interaction you control
Upkeep
the script and the defense change
A setup that has a chance
There is no light HTTP route through Shape. Every setup that works is a browser:
- Run a real, hardened browser that executes the script and carries no automation tells. The Web Scraping Club recommends "Playwright + Firefox with the right options"; our Playwright proxy guide covers the proxy side.
- Put a residential or ISP exit behind it in the site's country, sticky for the session.
- Make the fingerprint agree. TLS, HTTP/2, headers, user agent, language and time zone should describe one browser and one place.
- Pace like a person, above all on search, cart and sign-in.
- Check every response for content. A 200 can be the script page; look for the text you came for before you count a request as a success.
- Plan for upkeep. The client script changes, and a setup that works this month can stop next month.
Budget the traffic too. The script page alone weighed 256,700 bytes, about 14 times the median HTML document in the HTTP Archive's 2024 crawl, before the real page loads. Our DataDome guide prices a browser-based job per 1,000 pages at our residential rate.
Test before you scale
Before you point a real job at an F5 site, confirm your exits are alive and residential with our IP lookup and proxy checker. Then drive one full session through your browser and read what actually came back at each step: the page, the search results, the cart. Shape is often silent, so the content you receive is the only signal you can trust. If a hardened browser on a residential exit still gets script pages, the problem is the client, and more proxies will not fix it.
When the wall is not your problem to solve
Where the target is a platform we already cover, our scraper APIs return the data as JSON and keep the browser work on our side.
Limits of this guide
We ran no bypass tool, stealth browser or solver against F5 Shape, and we tested no proxy's success rate on it, ours included. Our requests were plain clients, so they show what fails, never what passes. In October two stores answered as F5 Shape stores, and Macy's refusal came from Akamai's edge. The script marker on Nordstrom's page is our observation, not an F5 document. No public counter reports Shape, so this page gives no site count. F5 does not publish what its script reads or how it scores. We will re-read the sources by January 22, 2027.
Sources
- F5, F5 completes acquisition of Shape Security, January 24, 2020, read October 22, 2026.
- F5, Distributed Cloud Bot Defense product page, read October 22, 2026: detection, what it protects, human-like bots.
- Our requests: a plain curl request with a Chrome 141 user agent from a home internet connection to nordstrom.com and macys.com, October 22, 2026, 12:53 UTC, and the same pages and abercrombie.com through our server's text reader that day; the retail bot-defense study of August 24, 2026, with the results on each store's page.
- The Web Scraping Club, Shape Bot Defence page of its open handbook on GitHub, read October 22, 2026: Wappalyzer does not recognize Shape, sites that stop working with developer tools open, Playwright with Firefox.
- Wappalyzer, security category, read October 22, 2026: no entry for Shape or F5's bot product.
- Fastly, Bot Management product documentation, last updated October 13, 2026, read October 22, 2026: the
_fs_ch_st_cookie signals that a challenge started and_fs_ch_cp_that it was completed. - HTTP Archive, Web Almanac 2024, Page Weight: the median HTML document of 18 KB.
